diff --git a/lib/classes/session/manager.php b/lib/classes/session/manager.php
index db17fc4252d..e60a29d4298 100644
--- a/lib/classes/session/manager.php
+++ b/lib/classes/session/manager.php
@@ -940,6 +940,9 @@ class manager {
 
         // Init session key.
         sesskey();
+
+        // Make sure the user is correct in web server access logs.
+        set_access_log_user();
     }
 
     /**
diff --git a/lib/classes/shutdown_manager.php b/lib/classes/shutdown_manager.php
index 955b0ed5dc4..5f0aec5dcf6 100644
--- a/lib/classes/shutdown_manager.php
+++ b/lib/classes/shutdown_manager.php
@@ -148,6 +148,10 @@ class core_shutdown_manager {
     public static function shutdown_handler() {
         global $DB;
 
+        // Always ensure we know who the user is in access logs even if they
+        // were logged in a weird way midway through the request.
+        set_access_log_user();
+
         // Custom stuff first.
         foreach (self::$callbacks as $data) {
             list($callback, $params) = $data;
diff --git a/lib/setuplib.php b/lib/setuplib.php
index d021649cd6b..30f92414c17 100644
--- a/lib/setuplib.php
+++ b/lib/setuplib.php
@@ -1876,7 +1876,7 @@ function set_access_log_user() {
                 apache_note('MOODLEUSER', $logname);
             }
 
-            if ($logmethod == 'header') {
+            if ($logmethod == 'header' && !headers_sent()) {
                 header("X-MOODLEUSER: $logname");
             }
         }